Use-After-Free Vulnerability in Linux Kernel's Socket Implementation

CVE-2026-43016

What is CVE-2026-43016?

A use-after-free vulnerability in the Linux kernel's socket implementation affects the handling of AF_UNIX sockets during data readiness calls. Specifically, in the function sk_psock_verdict_data_ready(), if a socket is orphaned while being accessed, it can lead to accessing a freed reference, resulting in a potential denial of service or buffer corruption. This issue arises when a peer socket's data readiness signal is processed after the socket state lock is released, allowing the freeing of the socket's structure after an RCU grace period. Therefore, the peer's socket may be accessed incorrectly, leading to heap memory corruption.

References